On Monday morning, the company’s finance system stops working. Invoices cannot be sent, payments cannot be approved, and the supplier has no clear answer about when the system will be back online.
Is it inconvenient or critical?
A consultancy may be able to manage a few hours of downtime. For a manufacturing company, where the finance system is connected to purchasing and deliveries, the same incident could quickly have much wider consequences.
An IT security risk assessment helps you understand that difference. It identifies what the company depends on, what could disrupt it, and where investing in better security will have the greatest effect.
Start with the business
Many companies begin with ransomware, phishing, data leaks and stolen passwords. That is understandable, but you cannot assess a threat properly until you know what it can affect.
Start with the company’s most important activities and the systems, data and suppliers behind them. If the finance system is unavailable for two hours, the consequences may be limited. After two days, cash flow, deliveries and customer communication could begin to suffer. After a week, the company is likely to have a very different problem.
If you need a clearer picture of your systems and data, Sikkerdigital offers the free Systemoverblikket tool. It provides prioritised recommendations based on the information you enter.
That conversation is more useful than a long list of every conceivable cyber threat.
Write scenarios people can assess
“Risk of a cyberattack” is too broad to support a useful decision. Describe what might actually happen:
An employee follows a link to a fake login page and enters their password. The attacker gains access to the account and downloads confidential customer documents.
A specific scenario gives you something concrete to assess. The company may already use multi-factor authentication, but perhaps the employee has access to far more documents than the role requires. The assessment then points to another weakness: access management.
Another scenario might involve the finance department changing a supplier’s bank details after receiving a convincing email. The fraudulent message is only part of the problem. If one employee can change payment information without an additional check, the payment process itself has created an opening.
The two incidents may look similar at first, but they require different controls.
Use the scores to start a discussion
A simple scale from 1 to 5 for likelihood and impact is often enough to begin. A system outage may be likely but have limited consequences because the company has a reliable fallback procedure. A large data breach may be less likely and still warrant immediate attention.
The reasoning behind the score matters more than the number itself. If the CFO considers an incident critical while IT rates it as moderate, you have found a disagreement worth examining. IT may not see the wider financial consequences, or the CFO may be unaware of an existing recovery procedure.
Those differences are exactly what the assessment should reveal.
Sikkerdigital provides a free IT risk assessment tool, guide and template. The material helps companies assess threats, likelihood and consequences before turning the findings into an action plan.
Look at the process around the employee
“Human error” appears in many risk registers, but the phrase rarely explains why the error occurred.
A finance employee may approve a fraudulent payment because urgent requests from management are common. A new colleague may fail to report a suspicious email because nobody has shown them where to send it. An HR employee may share a file incorrectly because the system gives more people access than expected by default.
In these situations, the employee is only one part of the risk. The real weakness may be in the process around them: time pressure, unclear procedures or a system that makes the mistake too easy to make.
The control should match the problem. An additional approval can reduce the risk associated with changes to bank details, while tighter access rights can limit the damage caused by a compromised account. Training becomes relevant when employees also need to recognise the situation and understand what the company expects them to do.
If invoice fraud features prominently in the risk assessment, the finance team should work with realistic payment requests. If accidental sharing of personal data presents a greater concern, HR and customer service need training in recipient checks and secure data sharing.
The topic comes from the risk assessment, not from the course catalogue.
Grape’s cybersecurity training for employees was developed in partnership with BDO. Its recommended programme contains nine modules covering subjects such as phishing, passwords, mobile devices, data sharing and security breaches. The course can be adapted to the audiences and working situations relevant to your organisation. Explore Grape’s cybersecurity training.
Decide which risks deserve a solution
Not every risk needs to be eliminated. If the potential impact is small and the solution expensive, accepting the risk may be the right decision.
Significant risks require a clearer response. Suppose the assessment identifies a high risk of fraudulent changes to suppliers’ bank details. The company decides that all changes must be confirmed by telephone using a trusted number, while larger payments require approval from two people. At the same time, the finance team receives training in common forms of invoice and CEO fraud.
The company has now acted on the risk. It still needs to assign an owner, set a deadline and decide how to check whether the changes work.
A risk without an owner is rarely addressed.
Companies that need a more formal process can consult the official Danish guide to information security risk management. Published by The Danish Agency for Societal Security, it covers risk identification, analysis, evaluation, treatment, acceptance and ongoing review, and connects the process with ISO/IEC 27001 and NIS2.
Revisit the assessment when something changes
A risk assessment gradually loses value as the company changes its systems, working procedures and suppliers. An annual review can serve as a fixed checkpoint, but significant changes should trigger a new assessment of the affected area.
The same applies after a security incident. If a phishing attack succeeds, do not focus solely on who clicked the link. Check whether the scenario appeared in the risk assessment, whether its likelihood was underestimated, and whether the existing controls worked as intended.
A risk assessment becomes useful when it changes a decision. Multi-factor authentication may move higher up the implementation plan, a payment procedure may be tightened, or certain employees may receive training in situations that genuinely present a risk.
It does not have to begin as a major project. Choose one critical business process, bring together the people who understand it, and describe three events that could cause it to fail. That will give you a far better starting point than an empty spreadsheet headed “IT risks”.
Has the assessment identified employee behaviour as a risk?
If employee actions contribute to one or more of your significant IT risks, the training should reflect situations employees genuinely face. These might include fraudulent payment requests, suspicious login pages, accidental data sharing or unsafe use of mobile devices.
